VYPR
← All advisories
Unrated severityNVD Advisory· Published Dec 9, 2020· Updated Aug 4, 2024

CVE-2020-26838

CVE-2020-26838

Description

SAP Business Warehouse, versions - 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 782, and SAP BW4HANA, versions - 100, 200 allows an attacker authenticated with (high) developer privileges to submit a crafted request to generate and execute code without requiring any user interaction. It is possible to craft a request which will result in the execution of Operating System commands leading to Code Injection vulnerability which could completely compromise the confidentiality, integrity and availability of the server and any data or other applications running on it.

Affected products

4
  • SAP/BW4HANAllm-create
    Range: 100, 200
  • SAP/Netweaver Business Warehousellm-fuzzy
    Range: 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 782
  • SAP SE/SAP Business Warehousev5
    Range: < 700
  • SAP SE/SAP BW4HANAv5
    Range: < 100

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.